NijvedaNijvedaWhere privacy
meets practice Contact us

Data privacy advisory and implementation

Where privacy meets practice.

India's new data protection law affects almost every business. We explain it in plain words, and help you put it into everyday practice.

Take the 2-minute self-check Understand the law
239days until 13 May 2027
when the main duties of the DPDP Act apply

The law in plain words

A new law that gives people control over their own information.

The Digital Personal Data Protection Act, 2023 tells businesses how they must treat information about people. Its detailed operating rules, the DPDP Rules, 2025, were issued on 13 November 2025.

What counts as personal data?

Anything that can point to a real person, on its own or combined with other information.

Name and photoMobile and emailAadhaar and PANBank and card detailsSalary and loansMedical reportsEmployee records and CVsLocation and device IDCall recordings and CCTV

Paper records are covered too, once they are scanned, typed or stored on a computer.

  • Applies toAlmost every business handling people's information digitally
  • ProtectsCustomers, employees, job applicants, patients, students and more
  • Enforced byThe Data Protection Board of India
  • Maximum penaltyUp to ₹250 crore for a single failure
  • Full compliance by13 May 2027

Who's who under the law

Using a bank and its customer as the example.

  • THE PERSON

    Data Principal

    The person the information is about. For a child, the parent acts on their behalf.

    e.g. the customer
  • THE BUSINESS

    Data Fiduciary

    Decides why and how the data is used, and carries the main responsibility.

    e.g. the bank
  • THE VENDOR

    Data Processor

    Handles data on the business's instructions. The business stays responsible.

    e.g. its call centre or cloud provider
The Data Protection Board hears complaints and imposes penalties. Large businesses named Significant Data Fiduciaries have extra duties.

What businesses must do

Nine duties, in plain words.

  • Tell people clearly

    Explain in simple words what you collect, why, and how to complain.

  • Ask for permission properly

    A clear yes before using data. No pre-ticked boxes.

  • Make it easy to say no later

    Withdrawing consent must be as easy as giving it.

  • Use it only for the stated purpose

    Nothing the person was not told about.

  • Keep it safe

    Access controls, encryption, and activity logs kept for at least a year.

  • Report leaks quickly

    Tell the Board and every affected person. A detailed report to the Board within 72 hours.

  • Delete it when done

    Erase data once its purpose is over, unless another law says keep it.

  • Take extra care with children

    Verified parental consent. No tracking or targeted ads aimed at children.

  • Hold vendors to the same standard

    Outside companies work only under a proper contract.

What people can ask for

Five rights every individual now has.

  • Right to know

    See what data a business holds and who it was shared with.

  • Right to correct

    Fix wrong, old or incomplete information.

  • Right to delete

    Have data erased when it is no longer needed.

  • Right to complain

    Complain to the business, then to the Board. Businesses must reply within 90 days.

  • Right to nominate

    Name someone to act for them in case of death or incapacity.

The cost of ignoring it

Penalties of up to ₹250 crore for a single failure.

₹250 crore
Not keeping data safe, leading to a leak
₹200 crore
Not reporting a leak to the Board and affected people
₹200 crore
Not following the extra rules for children
₹150 crore
Large businesses not meeting their extra duties
₹50 crore
Breaking any other part of the law

Maximum amounts under the Schedule to the Act.

The costs beyond fines

  • Customers lose trust and move to competitors
  • Bad press and damage to your brand
  • Large clients refuse to sign without proof of compliance
  • Investors find problems during due diligence
  • Management time lost handling complaints
  • Rushed fixes after an incident cost far more

Why now is the right time

▼ WE ARE HERE
  1. Aug 2023Act passed by Parliament
  2. 13 Nov 2025Rules issued, Board set up
  3. 13 Nov 2026Consent manager rules begin
  4. 13 May 2027All main duties apply

Readiness takes 6 to 9 months

Mapping data, fixing processes, rewriting documents, changing apps and training staff all take time.

Start in January, finish too late

A business that starts after the new year is likely to still be working when the deadline arrives.

Early movers gain

Fix things calmly, spread the cost, and show clients and partners you are ready first.

Common myths

What people often believe, and the facts.

MythThis law is only for big tech companies.

FactIt applies to every business that handles people's data digitally, from clinics and schools to shops and factories.

MythOur website has a privacy policy, so we are covered.

FactA policy is only a start. You also need proper consent, security, leak reporting, deletion and a way to answer requests.

MythIt only covers customer data.

FactIt also covers employees, job applicants, vendors' staff, visitors and anyone else whose data you hold.

MythOur IT or cloud vendor takes care of it.

FactYour business stays responsible, even when a vendor handles the data for you.

MythOur records are on paper, so it does not apply.

FactPaper records that are scanned, typed or stored on a computer are covered.

MythWe can deal with it after the deadline.

FactGetting ready takes months, and penalties can apply from the first failure.

Self-check

Is your business ready?

Answer ten quick questions. Nothing you tick leaves this page.

  1. 01We know what personal data we collect and where it is stored.
  2. 02We tell people, in simple words, why we collect it.
  3. 03We take clear permission, and people can withdraw it easily.
  4. 04We collect only what we really need.
  5. 05We delete data once we no longer need it.
  6. 06Our data is protected with proper security and activity logs.
  7. 07We have a plan to report a data leak on time.
  8. 08We can answer a request to see, correct or delete data.
  9. 09Our contracts make vendors protect our data.
  10. 10Our staff have been trained on handling personal data.
0/10

Answer the questions above

Your result appears here as you go.

Who we are

A specialist firm that makes privacy work in real life.

Nijveda helps businesses follow India's data protection law and other privacy laws, from the first review to everyday practice. We build systems your teams can actually use, not documents that look good on paper and fall apart in real life.

Following the law well is not just a cost. It is a business advantage.

Practical, not theoretical

Systems your people can run every day.

We start with your data

Every step rests on what you actually hold.

We check reality

How data really moves, not what documents say.

Business-minded advice

What the law requires, what it does not, and the sensible middle path.

Build new or improve

From scratch, or strengthen what you have.

Training that makes sense

Examples from your own business.

What we do

Eleven services, one integrated practice.

Each is available on its own or as part of a complete setup. Open any service to see what you receive.

Finding and mapping your data

We list the personal information your business holds and trace its journey from collection to deletion, across every system, team and location. If a map exists, we check it against what really happens.

What you get
  • List of the personal data you hold
  • Register of how each type is used
  • Simple diagrams of how data moves
  • Labels showing how sensitive it is
Checking where you stand

We compare your practices with the DPDP Act, Europe’s GDPR, industry rules and your own policies, and give you a clear, step-by-step plan with owners.

What you get
  • Report on how ready you are
  • Point-by-point checklist against the law
  • A readiness score
  • Action plan in order of priority
Assessing risks early

Before you launch something risky, such as a new app or sending data abroad, we assess what could go wrong and how serious it would be.

What you get
  • Risk checks for new products
  • Reviews of data sent abroad
  • A list of your privacy risks
  • Check on extra duties for large firms
Setting up safeguards

We design, set up and test practical protections: who can see what, collecting only what is needed, automatic deletion, activity logs and masking.

What you get
  • Safeguards matched to the law
  • Rules for keeping and deleting data
  • Access and activity log standards
  • Report on how well safeguards work
Policies and clear roles

We decide who is responsible for what, help set up a privacy team or appoint a Data Protection Officer, and write the policies you need.

What you get
  • Chart of who does what
  • Design of your privacy team
  • Complete set of policies
  • Schedule for how long to keep data
Handling people’s requests

A simple way to receive, verify and answer requests to see, correct or delete data, on time and with records to prove it.

What you get
  • Step-by-step request process
  • Request forms and identity checks
  • Reply formats and a deadline tracker
  • Complaint handling process
Managing vendors and partners

Outside companies are often the biggest hidden risk. We check them, rank them by risk, monitor them and fix their contracts.

What you get
  • Vendor checking questionnaire
  • Way to rank vendors by risk
  • Standard data protection terms
  • List of vendors who handle your data
Being ready for a data leak

A clear plan for who decides, when to inform the Board and affected people, and what records to keep. Plus practice drills.

What you get
  • Data leak response plan
  • Simple guide on when to report
  • Ready letters for Board and people
  • Practice drill and lessons learned
Training your people

Awareness for all staff and focused sessions for tech, product, marketing, HR, purchase, customer service and leadership.

What you get
  • Short awareness sessions
  • Team-specific workshops
  • Kit to train new joiners in-house
  • Quizzes and attendance records
Everyday advice and support

Quick, practical answers on new products, campaigns, sending data abroad and regulator questions, monthly or on call.

What you get
  • Reviews of new products and features
  • Privacy built into product design
  • Updates when the law changes
  • Written advice notes
Reporting to the board

Privacy turned into simple numbers and summaries your board and senior management can act on.

What you get
  • Simple privacy dashboard
  • Quarterly board report
  • Briefing notes for the audit committee
  • Progress tracking over time

How we work

Four clear steps, one journey.

  1. Understand

    Agree the scope, meet the teams that handle data, list systems and vendors, and map how data moves.

    You get: project plan and data map

  2. Check

    Confirm how the law applies, compare your practices point by point, assess risky activities and rank the gaps.

    You get: readiness report and action plan

  3. Fix

    Write notices and consent forms, set up request, leak and vendor processes, put safeguards in place, update contracts.

    You get: policies, formats and safeguards

  4. Sustain

    Train your teams, support the launch, run regular check-ups and report to management.

    You get: training records and health checks

Complete setup

We take care of the whole journey, from finding your data to training your teams. Best for businesses starting out.

Single project

Help with one area, such as vendor contracts, a risky new product or request handling. Best for businesses that have started.

Ongoing support

Everyday questions answered, product reviews and updates when the law changes. Best for businesses that want an expert on hand.

Industries we support

One set of processes for every rulebook.

Many businesses answer to industry rules as well as the DPDP Act. We bring them together, so one set of processes satisfies all of them.

  • Banks, NBFCs and fintech

    Customer, loan and KYC data, with RBI rules

  • Broking, investment and insurance

    Investor and policyholder data, with SEBI and IRDAI rules

  • Hospitals, clinics and labs

    Patient records, reports and insurance data

  • E-commerce, gaming and social media

    Consent at scale and deleting old accounts

  • Schools and education apps

    Children’s data and parental consent

  • IT, outsourcing and global centres

    Handling data for clients in India and abroad

  • Manufacturing and business groups

    Employee, dealer and customer data across group companies

  • Recruitment and staffing

    Candidate and employee data from hiring to exit

Words you may hear

Data Principal
The person the information is about
Data Fiduciary
The business that decides how data is used
Data Processor
An outside company handling data for the business
Significant Data Fiduciary
A large business named by the Government, with extra duties
Consent Manager
A registered platform that helps people give and manage consent
Data Protection Officer
The person in charge of privacy in a large business
Data breach
Any leak, loss or misuse of personal data
Impact assessment (DPIA)
A risk check before a risky activity

Get started

The best time to start is now.

Begin with a readiness check. In a few weeks it shows where your business stands, what matters most and what to fix first.

info@nijveda.com

What happens next

  1. A short call to understand your business
  2. A readiness check across your data, processes and vendors
  3. A clear action plan, in order of priority
  4. Hands-on help to put it in place